Privacy Notice regarding processing personal data for patients safety, medical information and quality purposes
This Privacy Notice is addressed to: • the adverse event/special case scenario reporters providing patient safety information concerning our products. • individuals requesting medical information or • submitting quality complaints. Novartis is committed to protecting your personal information and to being transparent about the information we are collecting and what we do with it. This notice provides you with information on how Novartis Israel Ltd. located at 36 Shacham St., Petach Tikva, Israel and its affiliates (hereinafter: “Novartis”, “we” or “us”), processes your personal data acting as a data controller. We invite you to read this Privacy Notice carefully, as it contains important information for you. Should you have any further question in relation to the processing of your personal data, we invite you to contact Novartis Data Privacy Department at [email protected].
For which purposes do we use your personal data and why is this justified? We may process personal data about you for the following purposes: • monitoring the safety of the medicinal products and medical devices, which includes detecting, assessing and preventing adverse events and reporting to health authorities; • responding to the medical information inquiries such as availability of a product, clinical data, dosing and administration, formulation and stability, interactions with other drugs or foods and special population; • addressing quality complaints regarding our products such as any fault of quality and/or effectiveness, stability, reliability, safety, performance or usage; • improving our products and services; • training or educational purposes; • provide you with adequate and updated information about disease, drugs, as well as our product and services; • answer any questions or requests you may have; • ensure compliance and reporting (such as complying with our policies and local legal requirements, conducting audits and defending litigation); • archiving and record-keeping; and • any other purposes imposed by law and authorities.
What information do we have about you? If you report an adverse event or a special case scenario (such as exposure during pregnancy, breastfeeding, overdose, lack of efficacy, etc.) concerning one of our products, submit a quality complaint or request medical information, we will ask for your name and contact details in order to be able to contact you in case additional information is needed and/or to respond to your inquiry. In case of the adverse event report, we will also collect information about your qualification in order to determine if you are a healthcare professional or a consumer and process the following data categories: • Contact details of the reporter, • Patient identification data, such as: identification code as provided by the adverse event reporting form, demographic information (e.g. initials, age, year or date of birth, sex, weight, height); • Health data: treatments administered, examination results, nature of the adverse events, personal or family history, diseases or associated events, risk factors; information on how the prescribes medicines were used as well as the therapy management. Additionally, if necessary for an adverse event assessment we may also collect and process: • Information on ancestry and descent of the person, whether it is a newborn, information on pregnancy and/or breastfeeding; • Occupational data: current and past occupations (only where this can be justified for the evaluation of the adverse event); • Information regarding consumption of tobacco, alcohol, drugs; • Information on lifestyle, life habits and behaviours, including for instance: dependence physical exercise (intensity, frequency, duration), diet and eating behaviour; • Sexual life; • Ethnicity, only in cases where the Summary of Product Characteristics (SmPC) includes specific information relating to the ethnic origin and according to the criteria defined in the SmPC.
Who has access to your personal data and to whom are they transferred? We will not sell, share, or otherwise transfer your personal data to third parties other than those indicated in this Privacy Notice. In the course of our activities and for the same purposes as those listed in this Privacy Notice, your personal data can be accessed by or transferred to: - The head of drug safety / medical information / quality assurance and their teams; - The general manager / qualified person and their representatives, within the limits of their attributions; - Entitled members of the legal and regulatory affairs department, depending on the claim files under their responsibility; - Audit department to check compliance with regulatory or internal requirements; - other Novartis Group companies, in particular Novartis AG; - Other pharma companies whose product may be at stake; - Health Care Professionals (such as physicians pharmacists, nurses) concerned by the report if allowed by the patient; - Service providers acting on behalf of Novartis Companies, such as providers of IT systems hosting and other services providers or providers of adverse events processing services (call center, in particular). The above third parties are contractually obliged to protect the confidentiality and security of your personal data, in compliance with applicable law. Your personal data can also be accessed by or transferred to any national and/or international regulatory, enforcement, public body or court where we are required to do so by applicable law or regulation or at their request. The personal data we collect from you may also be processed, accessed or stored in a country of Israel, which may not offer the same level of protection of personal data. However, If we transfer your personal data to external companies in other jurisdictions, we will make sure to protect your personal data by (i) applying the level of protection required under the local data protection laws applicable in Israel, and (ii) acting in accordance with our policies and standards. For intra-group transfers of personal data to our group companies, the Novartis Group has adopted Binding Corporate Rules - a system of principles, rules and tools, provided by European law, in an effort to ensure effective levels of data protection relating to transfers of personal data outside the European Economic Area
How long do we store your personal data? Personal data, except for simple contact information of the reporter, will be stored for as long as we reasonably consider necessary for achieving the purposes set out in this Privacy Notice and as it is required and/or permissible under applicable laws. Contact information of the reporter will be stored without time limitation, in case such reporter is not the subject of the personal data.
What are your rights and how can you exercise them? You have the right to: - access your personal data as processed by us and, if you believe that any information relating to you is incorrect, obsolete or incomplete, to request its correction or updating; - request rectification or erasure of your personal data that is inaccurate or processed for the purposes not stated above. - request the restriction of processing of your data to specific categories of processing; If you have a question or want to exercise the above rights, you may send an email to [email protected] or a letter at Novartis Legal Department at 36 Shacham St., Petach Tikva, Israel with a scan of your identity card for identification purpose, it being understood that we shall only use such data to verify your identity and shall not retain the scan after completion of the verification. When sending us such a scan, please make sure to redact your picture and national registry number or equivalent on the scan. If you are not satisfied with how we process your personal data, please address your request to our data protection officer at [email protected], who will investigate your concern. In any case, you also have the right to file a complaint with the competent data protection authorities, in addition to your rights above. Please note that you are under no legal obligation to provide us with any personal data, and the provision of personal data is subject to your consent. However, in case that you provide us with a personal data, please be inform that we may be obliged to keep and process your data under applicable law.
How will you be informed of the changes to our Privacy Notice? Any future changes or additions to the processing of your personal data as described in this Privacy Notice will be notified to you in advance through an individual notice through our usual communication channels (e.g. by email or via our internet websites).